2019-04-03 23:15:33 +02:00
[role="xpack"]
[[maps-search]]
2020-06-17 16:31:37 +02:00
== Search geographic data
2019-04-03 23:15:33 +02:00
2021-04-30 16:45:31 +02:00
Search across the layers in your map to focus in on just the data you want.
Layers that request data from {es} are narrowed when you submit a <<kibana-concepts-searching-your-data, search request>>.
Layers narrowed by semi-structured search and filters contain the filter icon image:maps/images/filter_icon.png[] next to the layer name in the legend.
Layers that request data from {es} using an <<index-patterns, index pattern>> with a configured time field are narrowed by the <<set-time-filter, global time filter>>.
2021-07-01 23:10:09 +02:00
These layers contain the clock icon image:maps/images/clock_icon.png[clock icon] next to the layer name in the legend. Use the time slider to quickly select time slices within the global time filter range.
Click previous and next buttons to advance the time slice backward or forward. Click play to animate your spatial temporal data.
2019-04-03 23:15:33 +02:00
You can create a layer that requests data from {es} from the following:
* <<vector-layer>> with:
2020-05-12 18:28:52 +02:00
** Documents
2019-04-03 23:15:33 +02:00
2020-05-12 18:28:52 +02:00
** Clusters and grid
2019-04-03 23:15:33 +02:00
2020-12-15 20:37:16 +01:00
** Point to point
2019-11-18 21:59:27 +01:00
** <<terms-join>>
2019-04-03 23:15:33 +02:00
2021-04-30 16:45:31 +02:00
** Top hits per entity
2020-12-15 20:37:16 +01:00
** Tracks
2020-05-12 18:28:52 +02:00
* <<heatmap-layer>>
2019-04-03 23:15:33 +02:00
[role="screenshot"]
image::maps/images/global_search_bar.png[]
2019-09-10 23:22:59 +02:00
[role="xpack"]
[[maps-create-filter-from-map]]
2020-06-17 16:31:37 +02:00
=== Create filters from a map
2019-09-10 23:22:59 +02:00
2021-07-01 23:10:09 +02:00
Create filters from your map to focus in on just the data you want. *Maps* provides three ways to create filters:
2019-09-10 23:22:59 +02:00
2021-07-01 23:10:09 +02:00
* <<maps-map-extent-filter>>
* <<maps-spatial-filters>>
* <<maps-phrase-filter>>
[float]
[[maps-map-extent-filter]]
==== Filter dashboard by map extent
A map extent shows uniform data across all panels.
As you pan and zoom your map, all panels will update to only include data that is visable in your map.
To enable filtering your dashboard by map extent:
* Open the main menu, and then click *Dashboard*.
* Select your dashboard from the list or click *Create dashboard*.
* If your dashboard does not have a map, add a map panel.
* Click the gear icon image:maps/images/gear_icon.png[gear icon] to open the map panel menu.
* Select *More* to view all panel options.
* Select *Enable filter by map extent*.
2019-09-10 23:22:59 +02:00
2020-11-10 20:03:49 +01:00
[role="screenshot"]
2021-07-01 23:10:09 +02:00
image::maps/images/enable_filter_by_map_extent.png[]
2020-11-10 20:03:49 +01:00
2019-09-10 23:22:59 +02:00
[float]
[[maps-spatial-filters]]
==== Spatial filters
2019-09-12 23:06:53 +02:00
A spatial filter narrows search results to documents that either intersect with, are within, or do not intersect with the specified geometry.
2019-09-10 23:22:59 +02:00
You can create spatial filters in two ways:
2021-04-30 16:45:31 +02:00
* Click the tool icon image:maps/images/tools_icon.png[], and then draw a shape, bounding box, or distance on the map to define the spatial filter.
2019-10-21 20:02:34 +02:00
* Click *Filter by geometry* in a <<maps-vector-tooltip-locking, locked tooltip>>, and then use the feature's geometry for the spatial filter.
2019-09-10 23:22:59 +02:00
Spatial filters have the following properties:
* *Geometry label* enables you to provide a meaningful name for your spatial filter.
2021-04-30 16:45:31 +02:00
* *Spatial relation* determines the {ref}/query-dsl-geo-shape-query.html#_spatial_relations[spatial relation operator] to use at search time.
2020-10-19 23:42:15 +02:00
* *Action* specifies whether to apply the filter to the current view or to a drilldown action. Only available when the map is a panel in a {kibana-ref}/dashboard.html[dashboard] with {kibana-ref}/drilldowns.html[drilldowns].
2019-09-10 23:22:59 +02:00
2021-07-01 23:10:09 +02:00
[role="screenshot"]
image::maps/images/create_spatial_filter.png[]
2019-09-10 23:22:59 +02:00
[float]
[[maps-phrase-filter]]
==== Phrase filters
A phrase filter narrows search results to documents that contain the specified text.
2019-10-21 20:02:34 +02:00
You can create a phrase filter by clicking the plus icon image:maps/images/gs_plus_icon.png[] in a <<maps-vector-tooltip-locking, locked tooltip>>.
2020-10-19 23:42:15 +02:00
If the map is a dashboard panel with drilldowns, you can apply a phrase filter to a drilldown by selecting the drilldown action.
2019-09-10 23:22:59 +02:00
2019-04-19 17:58:02 +02:00
[role="xpack"]
[[maps-layer-based-filtering]]
2020-06-17 16:31:37 +02:00
=== Filter a single layer
2019-04-19 17:58:02 +02:00
You can apply a search request to individual layers by setting `Filters` in the layer details panel.
Click the *Add filter* button to add a filter to a layer.
2019-06-26 17:56:23 +02:00
NOTE: Layer filters are not applied to *term joins*. You can apply a search request to *term joins* by setting the *where* clause in the join definition.
2019-04-19 17:58:02 +02:00
[role="screenshot"]
image::maps/images/layer_search.png[]
[role="xpack"]
[[maps-search-across-multiple-indices]]
2020-06-17 16:31:37 +02:00
=== Search across multiple indices
2019-04-03 23:15:33 +02:00
Your map might contain multiple {es} indices.
This can occur when your map contains two or more layers with {es} sources from different indices.
This can also occur with a single layer with an {es} source and a <<terms-join>>.
Searching across multiple indices might sometimes result in empty layers.
The most common cause for empty layers are searches for a field that exists in one index, but does not exist in other indices.
2019-09-10 23:22:59 +02:00
[float]
[[maps-disable-search-for-layer]]
2020-06-17 16:31:37 +02:00
==== Disable search for a layer
2019-09-10 23:22:59 +02:00
2019-11-18 21:59:27 +01:00
You can prevent the search bar from applying search context to a layer by configuring the following:
2019-12-11 21:53:58 +01:00
* In *Filtering*, clear the *Apply global filter to layer data* checkbox to turn off the global search context for the layer source.
2019-11-18 21:59:27 +01:00
* In *Term joins*, clear the *Apply global filter to join* checkbox to turn off the global search context for the <<terms-join, term join>>.
2019-09-10 23:22:59 +02:00
[float]
[[maps-add-index-search]]
2020-06-17 16:31:37 +02:00
==== Use _index in a search
2019-09-10 23:22:59 +02:00
2019-04-03 23:15:33 +02:00
Add {ref}/mapping-index-field.html[_index] to your search to include documents from indices that do not contain a search field.
For example, suppose you have a vector layer showing the `kibana_sample_data_logs` documents
and another vector layer with `kibana_sample_data_flights` documents.
(See <<add-sample-data, adding sample data>>
to install the `kibana_sample_data_logs` and `kibana_sample_data_flights` indices.)
If you query for
--------------------------------------------------
machine.os.keyword : "osx"
--------------------------------------------------
the `kibana_sample_data_flights` layer is empty because the index
`kibana_sample_data_flights` does not contain the field `machine.os.keyword` and no documents match the query.
[role="screenshot"]
image::maps/images/global_search_multiple_indices_query1.png[]
If you instead query for
--------------------------------------------------
machine.os.keyword : "osx" or _index : "kibana_sample_data_flights"
--------------------------------------------------
the `kibana_sample_data_flights` layer includes data.
[role="screenshot"]
image::maps/images/global_search_multiple_indices_query2.png[]